The auto updates are started by the avast service. The service runs under the LocalSystem account, i.e., not under the account you’re currently logged on.
The ‘avast iAVS4 Control Service’ is used only when invoking manual updates from non-administrative accounts…
In few words, you can update manually and automatically the virus database.
The program can only be updated by the automatic way while you’re on the common user account.

If it can detect, it can manage it I suppose. If you got an error (like David said about permissions), well, you’ll need to boot as an administrator to clean the infection or to schedule a boot time scanning.